Study. uk . com
  1. Home
  2. All questions
  3. Question 502

CompTIA Security+ study material · question 502 of 611

Three incidents are open at once. How should they be prioritised?

  1. By the CVSS score of the exploited vulnerability
  2. By the seniority of the reporting user
  3. By functional and informational impact and by recoverability
  4. In the order the reports were received
Show the answer

Answer: C. By functional and informational impact and by recoverability

First-in-first-out gives the same attention to a trivial event and a business-stopping one.

Source: NIST SP 800-61 Rev. 2 (NIST) — SP 800-61 Rev. 2 § 3.2.6 Incident Prioritization

Challenge yourself on this topic → Study as cards